Optimizing data entries in a log

ABSTRACT

Systems, methods and computer program products are provided. An indication that a log of data entries has reached a size limit for the log is received. The data entries are continually stored in the log over time, and each entry comprises an associated log level. A threshold log level for data entries in the log is determined. At least one new data entry for the log is received. An existing data entry having a log level less than or equal to the threshold log level is overwritten by the new data entry, so that the size limit is not exceeded.

BACKGROUND

The present invention relates to techniques for storing data entries ina log such as a log file, and, more specifically, to storing andmanaging data entries in a size-limited log and to optimize the datastored in the log.

SUMMARY

According to an embodiment, a method, computer system, and computerprogram product is provided. The present invention may include receivingan indication that a log of data entries has reached a size limit forthe log. Data entries are continually stored in the log over time. Eachdata entry comprises an associated log level. The method determines athreshold log level for data entries in the log. The method receives atleast one new data entry for the log. The method overwrites, with thenew data entry, an existing data entry having a log level less than orequal to the threshold log level, so that the size limit is notexceeded.

According to another embodiment, a system is provided. The systemincludes a processor for processing data entries in a log. The systemfurther includes data storage for storing the data entries in the log.Data entries are continually stored in the log over time. Each dataentry includes an associated log level. The processor is configured toreceive an indication that the log of data entries has reached a sizelimit for the log. The processor is further configured to determine athreshold log level for data entries in the log. The processor isconfigured to receive at least one new data entry for the log. Theprocessor is configured to overwrite, with the new data entry, anexisting data entry having a log level less than or equal to thethreshold log level so that the size limit is not exceeded.

According to yet another embodiment, a computer program product isprovided. The computer program product includes a computer readablestorage medium having program instructions for processing and storingdata entries in a log embodied within. Data entries are continuallystored in the log over time. Each data entry includes an associated loglevel. The program instructions are executable by a processor to causethe processor to: receive an indication that the log of data entries hasreached a size limit for the log; determine a threshold log level fordata entries in the log; receive at least one new data entry for thelog, and overwrite, with the new data entry, an existing data entryhaving a log level less than or equal to the threshold log level so thatthe size limit is not exceeded.

According to a further embodiment, a computer implemented method isprovided. In response to determining that the size of an existing log ofdata entries is to be reduced to within a predefined size limit for thelog, the method includes determining a threshold log level for dataentries in the log, removing, from the log, one or more existing dataentries having a log level less than or equal to the threshold loglevel, and determining whether the log has reached a size within thepredetermined size limit. If it is determined that the log has notreached a size within the predefined size limit, the method furthercomprises: repeating the steps above recursively, until it is determinedthat the log has reached a size within the predefined size limit.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other objects, features and advantages of the presentinvention will become apparent from the following detailed descriptionof illustrative embodiments thereof, which is to be read in connectionwith the accompanying drawings. The various features of the drawings arenot to scale as the illustrations are for clarity in facilitating oneskilled in the art in understanding the invention in conjunction withthe detailed description. In the drawings:

FIG. 1 depicts an exemplary networked computer environment according toan embodiment;

FIG. 2 depicts an example log containing log entries having differentlog levels, according to an embodiment of the present invention;

FIG. 3 is a flowchart of a method for optimizing the data stored in alog layers according to an embodiment of the present invention;

FIG. 4 is a flowchart of a method for logging entries, suitable for usein the method of FIG. 2, according to an embodiment of the presentinvention;

FIG. 5 is a block diagram of a computing system according to anembodiment of the present invention;

FIG. 6 depicts a cloud computing environment according to an embodimentof the present invention; and

FIG. 7 depicts abstraction model layers according to an embodiment ofthe present invention.

DETAILED DESCRIPTION

Detailed embodiments of the claimed structures and methods are disclosedherein; however, it can be understood that the disclosed embodiments aremerely illustrative of the claimed structures and methods that may beembodied in various forms. This invention may, however, be embodied inmany different forms and should not be construed as limited to theexemplary embodiments set forth herein. In the description, details ofwell-known features and techniques may be omitted to avoid unnecessarilyobscuring the presented embodiments.

Embodiments of the present invention relate to the field of computing,and more particularly to techniques for storing data entries in a logsuch as a log file, and, more specifically, to storing and managing dataentries in a size-limited log and to optimize the data stored in thelog. Therefore, the present embodiment has the capacity to improve thetechnical field of data processing by managing data entries of a log.

Event generation and logging is commonly used in the field of computingto capture information about the operation of a computing system. Forexample, event logging techniques may be used to monitor the operationof a computing system, application, service or the like, and to generateevents in response to detection of predefined actions or conditions.Generated events are typically stored or “logged” in a log in datastorage, for use by a user to analyze the operation and identify anddiagnose problems that may arise.

The size of a log is typically limited by the amount of data storageavailable for storage of the event data. In particular, a predefinedamount of data storage may be allocated for the purpose of storing thelog, for example as a size-limited “log file”. However, a log file maycontinually receive event data over a prolonged time period.Furthermore, the entries to be logged may be generated by differentevents sources, and so data entries may not conform to the same size andform. Thus, a strategy is needed to manage a log file, so that theamount of event data stored does not exceed the memory size limit forthe log file.

One conventional strategy for managing the size of a log file is knownas “log rotation”, which involves overwriting older entries in the logfile with new entries. This leads to the overwriting of the oldestentries, irrespective of the information therein. In consequence,significant information contained in some of the older entries, whichmay assist the user in diagnosing problems, may be lost. Anotherstrategy is to limit the types of events that are stored in the logfile. For example, generated events may be filtered and stored based ona parameter of the event data, such as a severity level exceeding athreshold. This leads to the loss of event data, which may containsignificant information, for example, indicating events leading up to aserious event, such as a failure. Thus, significant information, whichmay assist the user in diagnosing problems, may be lost. A furtherstrategy is to increase the amount of data storage available for storingthe log file. For instance, the log file may be stored in a distributedmemory system (e.g., provided by a distributed logging service or acloud based storage) instead of a more limited local memory (e.g., adedicated local resource in an enterprise network). This prevents lossof event data but increases the consumption of data storage, processing,communication and other resources, and adds to the associated costs.Furthermore, the storage of log files in a distributed memory system maylead to difficulties in accessing the event data, due to call failuresand/or delays. Finally, yet another strategy is compressing the logfile. This requires increased processing resources (i.e., tocompress/decompress data) and may not represent a complete solution,since data storage space for the compressed data may eventually run out.

The present disclosure provides methods, systems and computer programproducts for improved management of size-limited log files for storingdata entries such as event data. In particular, example implementationsof the present disclosure maintain the size of the log file within adefined size limit, whilst prioritizing the retention of moresignificant and/or useful entries. Thus, the data stored in the log fileis optimized (e.g., by retaining significant event entries andassociated event data). Whilst the following description relates to alog file of data entries comprising events and event data, it will beappreciated that the techniques of present disclosure are widelyapplicable to other types of log file, and associated types of dataentries, in a variety of different contexts.

In the present disclosure, the term “log file” is used to refer to arecord of data entries, such as events, also known as a “log”. The term“log file” is not limited to any particular type of data structure ordata storage, but is intended to encompass any suitable form of recordor log containing data entries in any type of storage medium.

Referring to FIG. 1, an exemplary networked computer environment 100 isdepicted, according to an embodiment. The networked computer environment100 may include client computing computer 102 and a server 112interconnected via a communication network 114. According to at animplementation, the networked computer environment 100 may include aplurality of client computing devices 102 and servers 112, of which onlyone of each is shown for illustrative brevity.

The communication network 114 may include various types of communicationnetworks, such as a wide area network (WAN), local area network (LAN), atelecommunication network, a wireless network, a public switched networkand/or a satellite network. The communication network 114 may includeconnections, such as wire, wireless communication links, or fiber opticcables. It may be appreciated that FIG. 1 provides only an illustrationof one implementation and does not imply any limitations with regard tothe environments in which different embodiments may be implemented. Manymodifications to the depicted environments may be made based on designand implementation requirements.

Client computing device 102 may include a processor 104 and a datastorage device 106 that is enabled to host and run a software program108 and a log management program 110A and communicate with the server112 via the communication network 114, in accordance with an embodimentof the invention. Client computing device 102 may be, for example, amobile device, a telephone, a personal digital assistant, a netbook, alaptop computer, a tablet computer, a desktop computer, or any type ofcomputing device capable of running a program and accessing a network.As will be discussed with reference to FIG. 5, the client computingdevice 102 may include internal components and external components,respectively.

The server 112 may be a laptop computer, netbook computer, personalcomputer (PC), a desktop computer, or any programmable electronic deviceor any network of programmable electronic devices capable of hosting andrunning a log management program 110B and a database 116 andcommunicating with the client computing device 102 via the communicationnetwork 114, in accordance with embodiments of the invention. As will bediscussed with reference to FIG. 5, the server 112 may include internalcomponents and external components, respectively. The server 112 mayalso operate in a cloud computing service model, such as Software as aService (SaaS), Platform as a Service (PaaS), or Infrastructure as aService (IaaS). The server 112 may also be located in a cloud computingdeployment model, such as a private cloud, community cloud, publiccloud, or hybrid cloud.

According to the present embodiment, the log management program 110A,110B may be a program capable of maintaining a log file within a maximumdata storage size while retaining priority log entries. The logmanagement method is explained in further detail below with respect toFIGS. 3 and 4.

Referring now to FIG. 2, an extract of an example log file is shown,according to an embodiment. FIG. 2 shows an extract of an example logfile storing data entries comprising events. In particular, the log filecomprises events that are generated from monitoring a service forgenerating a project provided by a computing system (herein called“service generator”). In FIG. 2, each log entry (i.e., event) isrepresented by a row and comprises a plurality of data fields. The datafields include: a correlation ID field; a date and time field; aseverity level field; a device/service name field, and an event datafield. The correlation ID field comprises an identifier for the userrequest associated with the service generation that is monitored. Thus,all events arising during monitoring the generation of a particularproject in response to a single user request contain the samecorrelation ID. The data and time field includes the date and time ofthe event. The severity level field indicates one of a plurality ofpossible severity levels (herein more generally called “log levels”)associated with the event. The event data field comprises text and/orother information about the event.

The severity level field may also be referred to as a log level. The loglevel is a parameter that is typically part of each log entry. Log levelvalues are ranking values, with the ranking corresponding to the levelof severity of a problem associated with a computing event that lead tothe creation of the log entry in the first place. Log level values maybe numerical (0, 1, 2, 3) or described in words (for example: “normaloperations,” “possible problem,” “small problem, and “big problem”).

In the log file extract, five example event entries are shown. The evententries are associated with a single user request having correlation ID“1234”. As a skilled person will appreciate, the full log file maycontain large numbers of further event entries associated with more thanone user requests, which may amount to many hundreds or thousands ofentries, or more. The illustrated event entries have three severitylevels (i.e., log levels), in particular a lowest log level called“INFO”, a next log level called “WARNING” and a highest log level called“ERROR”. The severity level of the event is typically determined basedon the particular monitored or detected operation that is identified inthe event. For example, some events may be generated at defined stagesof normal operation (e.g., at key stages during the generation of aproject by the service) and so assigned the lowest level “INFO”. Otherevents may be generated when an abnormal condition is detected (e.g., anunexpected condition during generation of the project by the service)and so assigned one of the higher levels “WARNING” or “ERROR”, dependingupon the detected condition. The device/service name is shown as“generator-service-enablement: service A”, and“generator-service-enablement: service B”. The event data field containstext-based information associated with the particular event. As shown inFIG. 2, the event data in event entries with the log level “INFO”typically contain more generic information, denoting normal stages ofoperation such as “Adding Readme”, “Adding Instrumentation”, and “AddingDeployment service environment information for service A”. Such generictext is typically replicated in the log entries for all user requests(assuming normal operation). In contrast, event entries with the loglevels “WARNING” and “ERROR” contain more specific and targetedinformation about a detected, typically unexpected condition or thelike, such as “Nothing to process for node” and “Expected something toprocess”. As the skilled person will appreciate, in some instances a“WARNING” level event may precede an “ERROR” level event having the samecause. In the illustrated example, a common cause of two such events isthe absence of expected data for processing by “service B”. A firstevent is generated at the “WARNING” level (e.g., when the missing datadoes not arrive at the expected time) and a subsequent second event isgenerated at the “ERROR” level (e.g., when the data is still missingafter a further time period indicating an error). Thus, enablesunexpected conditions identified by events at the “WARNING” level to beresolved automatically, without generating an “ERROR” level event.Conversely, “ERROR” level events can typically be traced back to earlier“WARNING” level events, which may, in turn, contain significantinformation to help users to diagnose problems (e.g., to identify theroot cause of the error condition causing the “ERROR” level event).

Referring now to FIG. 3, an operational flowchart of a method 200 foroptimizing the data stored in a log layers in accordance with an exampleimplementation of the present disclosure is shown. In particular, themethod 200 manages a log file of event data entries, so that the eventdata stored in the log file does not exceed a predefined data storagesize limit (i.e., amount of space for data available in data storageallocated for the log file). As the skilled person will appreciate, thedata storage allocated for the log file may comprise any type of storagemedium, including, but not limited to, cloud storage.

Method 200 starts at step 205. In particular, the method may start atstep 205 when a log file is created, for example upon start-up of asystem or launch of an application, service or the like with, which thelog file is associated.

At step 210, the method 200 stores or “logs” event entries in the logfile. For example, events may be received from an event source thatmonitors the system, application, service or the like, and generatesevents associated with detected operating conditions or the like, asdescribed above and well known in the art. Thus, step 210 may store thedata fields associated with each received event in log file. In someexample implementations, events may be received from multiple eventsources and/or generators for aggregation into a single log file.

At step 220, the method 200 determines whether the size limit for thelog file has been reached. In particular, the log file may be allocateda predetermined amount of data storage space, which cannot be exceeded.Thus, in example implementations, step 220 may compare the data storagespace utilized by the log file with the allocated data storage space.Step 220 may be performed periodically, for example at periodic timeintervals or after a predetermined number of events have been stored. Inexample implementations, step 220 may be performed after a single eventis stored in the log file. As the skilled person will appreciate, step220 may determine that the size limit has been reached when there isinsufficient data storage space available for the log file to store atleast one data entry.

If step 220 determines that the log file size limit has not beenreached, the method 200 returns to step 210 and continues to storeentries in the log file. However, if step 220 determines that the logfile size limit has been reached, then there is insufficient datastorage space for storing new event entries, and the method 200 proceedsto step 230.

At step 230, the method 200 sets a threshold log level for event entriesto be overwritten. In particular, the threshold log level defines upperlimit for the log level (e.g., “severity level” of the event orequivalent) of existing entries in the log file that are permitted to beoverwritten by new event entries. In an example implementation of thepresent disclosure, step 230 initially sets the threshold log level to alevel below the highest log level. For example, if the event entrieshave ten different log levels from 1 (the lowest/least severe log level)to 10 (the highest/most severe log level), step 230 may set the initialthreshold log level at 5 or 6, according to application requirements. Inanother example, if the event entries have three different log levels“INFO, “WARNING” and “ERROR” as described above with reference to FIG.2, step 230 may set the initial threshold log level at “INFO” or“WARNING”.

At step 240, the method 200 stores or “logs” new event entries in thelog file by overwriting existing entries having log levels up to andincluding the threshold log level. In particular, step 240 may selectexisting event entries having log levels up to and including thethreshold log level, for overwriting with new event entries. Inaccordance with example implementations of the present disclosure, step240 may overwrite event entries in the log file using a defined scheme,which attempts to retain existing entries containing significantinformation. An example of a suitable scheme that may be used by step240 is described below with reference to FIG. 4. Notably, since step 240only overwrites existing entries having the lower log levels (i.e., upto and including the threshold log level), all existing entries havingthe higher log levels (i.e., above the threshold log level) are retainedin the log file. Thus, significant information, which is typicallycontained in event entries having the higher log levels (i.e., loglevels leading up to the highest log level), is retained in the logfile.

At step 250, the method 200 determines whether there are existingentries in the log file that can be overwritten. Step 250 may beperformed periodically, for example at periodic time intervals or aftera predetermined number of events have been stored by overwritingselected existing events. In example implementations, step 250 may beperformed after a single event is stored in the log file. As the skilledperson will appreciate, step 250 may determine that there are noexisting entries in the log file that can be overwritten when there areno more existing entries in the log file having log levels up to andincluding the threshold log level or when step 240 is unable to storenew data entries by overwriting existing entries.

If step 250 determines that there are existing entries in the log filethat can be overwritten, the method 200 returns to step 240 andcontinues to store event entries by overwriting existing entries havinglog levels up to and including the threshold log level in accordancewith the defined scheme. However, if step 250 determines that there areno more existing event entries that can be overwritten, the method 200proceeds to step 260.

At step 260, the method 200 determines whether the current threshold loglevel is at a defined highest possible threshold log level (herein“maximum threshold log level”). The maximum threshold log level may bedefined below or at the highest log level for the event entries. Thus,in the above example of event entries have ten different log levels from1 (the lowest/least severe log level) to 10 (the highest/most severe loglevel), the maximum threshold log level may be defined as 8, 9 or eventhe highest log level 10, according application requirements. In theexample of event entries have three different log levels “INFO,“WARNING” and “ERROR” as described above with reference to FIG. 2, themaximum threshold log level may be defined as “WARNING” or “ERROR”.

If step 260 determines that the current threshold log level is not equalto the maximum threshold log level, and thus is below the maximumthreshold log level, the method proceeds to step 270 which increases thethreshold log level. In an example implementation of the method 200according to FIG. 3, step 270 increases the threshold log level by one.In another example implementation, step 270 may increase the thresholdlog level by another amount, according to application requirements. Forexample, if the events have ten possible log levels, step 270 mayincrease the threshold log level by two, or if the events have fiftypossible log levels, step 270 may increase the threshold log level byfive. The method 200 then returns to step 240, which continues to storenew event entries in the log file based on the increased threshold loglevel. The method 200 then continues in a loop through steps 240 to 270,until step 260 determines that the current threshold log level is equalto the maximum threshold log level and the method 200 proceeds to step280.

At step 280, the method 200 stores or “logs” event entries according toa default overwriting scheme. For example, the method 200 may overwriteexisting event entries with new entries based on a predeterminedparameter thereof, such as age, in accordance with a conventional “logrotation” scheme. The method may end at step 285.

Referring now to FIG. 4, an operational flowchart of a method 300 forstoring entries in a log file when a size limit for the log file hasbeen reached is shown, in accordance with an example implementation ofthe present disclosure. For example, the method 300 may be performedduring steps 240 and 250 of the method 200 of FIG. 2. The method 300illustrates a scheme for optimizing the data in the log file, byretaining existing data entries that may have significant information,as described above. Other schemes are possible and contemplated by thepresent disclosure.

The method 300 starts at step 305. For example, the method may start inresponse to setting a threshold log level for event entries to beoverwritten, in accordance with step 230 or step 270 of the method 200of FIG. 3.

At step 310, the method identifies existing event entries in the logfile having log levels up to and including the threshold log level. Forexample, step 310 may determine the log level for the existing evententries and identify the existing entries having log levels up to andincluding the threshold level. In example implementations, step 310 mayidentify existing event entries having each log level, from the lowestlog level up to and including the threshold log level. Optionally, step310 may also determine the data size of the identified existing entriesand other relevant parameters, according to application and/or schemerequirements.

At step 320, the method sets the “overwrite log level” at the lowest loglevel for event entries. Thus, in the above example of event entrieshave ten different log levels from 1 (the lowest/least severe log level)to 10 (the highest/most severe log level), the overwrite log level isset to 1. In the example of event entries have three different loglevels “INFO, “WARNING” and “ERROR” as described above with reference toFIG. 2, the overwrite log level is set to “INFO”.

At step 330, the method receives a new event for the log file, forexample from one of a plurality of event sources, as described above. Atoptional step 340, the method determines whether the log level of thenew event is above the current overwrite log level.

If step 340 determines that the new event has a log level equal to thecurrent overwrite log level, the method proceeds to step 350 whichdiscards the new event. In particular, in accordance with an overwritingscheme implementing optional step 340, event entries with log levelsequal to the current overwrite log level are not retained, and so thenew event is not stored in the log file. The method then returns to step330. However, if step 340 determines that the new event has a log levelabove the current overwrite log level (or step 340 is omitted), themethod proceeds to step 360.

At step 360, the method selects, and overwrites with the new event, anexisting event entry in the log file having a log level equal to theoverwrite log level. In example implementations, the existing entry maybe selected based on other parameters (e.g., data fields or properties)thereof in addition to log level, such as data size, age and the like,according to application requirements. Notably, the data size of theselected existing entry to be overwritten should be greater than orequal to the data size of the new event entry to be stored in the logfile. In some example implementations, multiple existing entries may beselected and overwritten in step 360, when necessary, for example, dueto the size of the new data entry. Following selection and overwritingof the existing entry in step 360, or if step 360 is unable to select anexisting entry for overwriting, the method proceeds to step 370.

At step 370, the method determines whether there are existing entries inthe log file having the current overwrite log level, and thus existingentries that can be overwritten. If step 370 determines that there areexisting entries having the current overwrite log level, the methodreturns to step 330. The method then continues in a loop through steps330 to 370, until step 370 determines that there are no longer anyexisting entries having the current overwrite log level, and the methodproceeds to step 380.

At step 380, the method determines whether the current overwrite loglevel is equal to the threshold log level. Recall that the overwrite loglevel is initially set to a lowest log level for event entries, whilstthe threshold log level may be set at a higher log level. In particular,in the above example of event entries have ten different log levels from1 (the lowest/least severe log level) to 10 (the highest/most severe loglevel), the threshold log level may be set to 5 or 6 and the initialoverwrite log level is set to 1, which is lower than the threshold loglevel.

Accordingly, if step 380 determines that the current overwrite log levelis not equal to the threshold log level, the method proceeds to step 390which increments the overwrite log level. In example implementationsaccording to the method 300 of FIG. 4, step 390 increments the overwritelog level by one. In other example implementations, step 390 mayincrement the overwrite log level by another amount, according toapplication requirements. For example, if the events have ten possiblelog levels, step 290 may increment the overwrite log level by two, or ifthe events have fifty possible log levels, step 270 may increment theoverwrite log level by five. The method then proceeds in a loop throughsteps 330 to 390, in which step 360 overwrite existing entries havingthe new (i.e., higher) overwrite log level, until step 380 determinesthat the current overwrite log level is equal to the threshold loglevel.

If step 380 determines that the current overwrite log level is equal tothe threshold log level, the method ends at step 395. In the case thatthe method 300 of FIG. 4 is performed at steps 240 and 250 of the method200 of FIG. 3, when the method 300 ends at step 395, the method 200returns to step 260, which may increase the threshold log level, asdescribed above.

As the skilled person will appreciate, the method 300 described withreference to FIG. 4 is just one example of a scheme for overwritingexisting entries in a log file having log levels up to a threshold loglevel, with the aim of preserving significant information in the logfile, by retaining existing entries that may have such significantinformation in the log file. Various alternative approaches, and/ormodifications to the described example scheme, are possible andcontemplated by the present disclosure.

In example implementations of the present disclosure, steps 340 and 350of the method 300 of FIG. 4 may be omitted. In this case, new events maybe stored in the log file irrespective of log level. Thus, step 360 maystore new entries having the current overwrite log level, which maybecome candidates for selection for overwriting by subsequent receivedentries.

The method 300 described with reference to FIG. 4 assumes that the loglevel is present as a data field in the new events to be stored in thelog file. However, in some example implementations, events may not havea separate field indicating a log level (e.g. severity level). In thiscase, the method may infer a log level for an event, based on content inone or more fields of the event. For example, the method may infer ahighest/most severe log level for an event, when its event data containswords such as “error”, “failure” or “fault”. Conversely, the method mayinfer a lowest/least severe log level for an event, when its event datacontains words such as “info”, “comment” or “remark”. A log levelbetween the highest and lowest log levels may be inferred for an eventin a similar way, based on the presence of words or similar contentfeatures in the event data. The inferred log level for a new event maybe stored within the data entry in the log file, for use in selectingexisting entries to be overwritten as described above.

The described example implementations relate to the storage of newentries in a size-limited log file, by overwriting existing entries,when the size limit would otherwise be exceeded. Other applications ofthe present disclosure are possible and contemplated. For example, thepresent disclosure may be used when transferring the data entries in alog file to a smaller storage space. Thus, if the smaller storage spaceis insufficient to store all of the existing data entries, data entriesmay be selected in accordance with the described techniques, and deletedfrom the log file instead of being overwritten. Thus, the overall sizeof the log file is reduced so that it can be stored in the target,smaller storage space without loss of significant data.

Referring now to FIG. 5, a block diagram of a computing system 400 isshown, in accordance with an example implementation of the presentdisclosure. In particular, the computing system 400 comprises acomputing device 410, such as a server, the operations of which aremonitored for event generation as described above. Computing device 410comprises a memory unit 420, a processing unit 430 and an input/output(I/O) unit 440. Computing device 410 may include user interface devices450 connected to I/O unit 440. User interface devices 450 may includeone or more of a display (e.g., screen or touchscreen), a printer, akeyboard, a pointing device (e.g., mouse, joystick, touchpad), an audiodevice (e.g. microphone and/or speaker) and any other type of userinterface device. I/O unit 440 may also be connected to a network 460 tosend and receive data to other network devices 465 connected to thenetwork 460. Network 460 may comprise any suitable wired or wirelessdata communications network, such as a local area network, wide areanetwork or the Internet.

Memory unit 420 comprises one or more processing modules 470, forperforming methods in accordance with the present disclosure, and a logfile 480 having a limited size. Each processing module 470 may compriseinstructions for execution by processing unit 430 for processing dataand/or instructions received from I/O unit 440 and/or data and/orinstructions stored in memory unit 420. In particular, processingmodules 470 may include service module 472 for implementing a monitoredservice application or the like, and an event generating module 464associated therewith. As the skilled person will appreciate, the presentdisclosure is not limited to any particular type of application programor software. Rather, the teachings of the present disclosure may be usedin conjunction with any type of computing system, process orapplication, the operation of which is monitored, and for which eventsare generated for storage in a log file.

Event generating module 474 may monitor operations of the processingperformed by the service module 472 and generate events for storing inlog file 480. In accordance with example implementations of the presentdisclosure, processing modules 470 further include an event loggingmodule 476 for receiving events from the event generating module 474 andstoring the events in the size-limited log file 480 in accordance withthe methods disclosed herein. In particular, event logging module 476may be configured to log events for the application associated withservice module 472 in the log file 480 in accordance with the method ofFIG. 3, optionally in conjunction with the method of FIG. 4.

In the example implementation of FIG. 5, a single event generationmodule 474 is provided for monitoring the processing and operations of asingle service module 472 of computing device 410, and for generatingevents associated therewith. As a skilled person will appreciate, inother example implementations, multiple event sources/generators may beemployed, each associated with monitoring, and generation event, for acorresponding computing system, application, service or the like for acommon purpose (e.g., delivery of a particular service). Such eventsources/generators and associated systems may be configured in adistributed arrangement, for example connected to the network 460, andmay send events for storage in the log file 480 in allocated datastorage, such as in memory unit 420 of computing device 410. In otherexample implementations, the log file 480 itself may be located in adistributed storage arrangement (e.g., one or more network devices 465connected to network 460). For example, log file 480 may be asize-limited allocation in cloud data storage provided by a cloudservice provider.

With continuing reference to FIG. 5, a computer program product 490 maybe provided. The computer program product 490 may include computerreadable media 492 having storage media 494 and program instructions 496(i.e., program code) embodied therewith. The program instructions 496may be loaded onto memory unit 420 of computing device 410 via I/O unit440, for example by one of user interface devices 450 or network devices465 connected to network 460. The program instructions 496 may compriseevent logging module 476 for storing events for the user application inthe log file 480, in accordance with one or more of the methodsdiscloses herein, as described above.

An application of the methods of the present disclosure is in relationto a code generation service of IBM® Corporation (IBM® is a registeredtrademarks of International Business Machines Corporation). Typically, acode generation service runs a number of code generators to produce aproject, which is downloaded by service customers. Log events from themultiple code generators may be captured and aggregated into a singlelog file, which may be stored in a distributed data service. Such logevents are composed of a lowest level called INFO to a highest levelcalled ERROR and include event data, as described above with referenceto FIG. 1. Typically, events with the lowest level INFO are somewhatgeneric, whilst events with the highest log level ERROR are moreinformative. Events are created by sub-generators that are writtenindependently of the main code generation service functionality. Thismeans is not possible to know, in advance, how many entries will bewritten by the sub-generators in practice, or the size or form (e.g., interms of number and type of data fields) of those entries. Thus, it isdifficult to ensure that the data storage space allocated to the logfile enables all entries from the sub-generators to be stored.Accordingly, the described methods may be used to manage the events fora code generation service in the log file, in order to prevent “out ofmemory” conditions, whilst ensuring that as much as possible, entrieswith the most significant information are retained (i.e., notoverwritten) for use for analysis and problem diagnosis.

An implementation of the methods of FIGS. 3 and 4 described above isapplied to events for a code generation service of IBM® Corporation.Events are generated by sub-generators and provided to a loggingfunction for storing in a log file. The events have three log levels,from lowest to highest: INFO, WARNING, ERROR. The method may proceed asfollows:

-   Step 1. The code generation service receives a code generation    request from a user.-   Step 2. A new logging function is created with its log level set to    INFO and associated with the UUID for the request.-   Step 3. One or more sub-generators are invoked, which generate    events associated with the code generation operation and provide the    events to the logging function.-   Step 4. All received events are logged until the size limit of the    log file is reached.-   Step 5. The logging function sets the threshold log level to    WARNING.-   Step 6. Subsequent events are handled as follows:    -   Step 6.1. New events at the INFO level are discarded, and    -   Step 6.2. For new events at the WARNING/ERROR level, existing        entries at the INFO level in the log file are overwritten in        reverse time order (i.e., oldest first).-   Step 7. Events are logged until no more overwrite candidate entries    at INFO remain, at which point the threshold log level is raised to    ERROR.-   Step 8. Subsequent events are handled as follows:    -   Step 8.1 New entries at the INFO or WARNING level are discarded.    -   Step 8.2 For new entries at the ERROR level, entries at the        WARNING level (or lower) are overwritten in reverse time order.

It may be appreciated that FIGS. 1-5 provides only an illustration of animplementation and does not imply any limitations with regard to howdifferent embodiments may be implemented. Many modifications to thedepicted environments may be made based on design and implementationrequirements.

The programs described herein are identified based upon the applicationfor which they are implemented in a specific embodiment of theinvention. However, it should be appreciated that any particular programnomenclature herein is used merely for convenience, and thus theinvention should not be limited to use solely in any specificapplication identified and/or implied by such nomenclature.

Embodiments of the invention may be provided to end users through acloud computing infrastructure. Cloud computing generally refers to theprovision of scalable computing resources as a service over a network.More formally, cloud computing may be defined as a computing capabilitythat provides an abstraction between the computing resource and itsunderlying technical architecture (e.g., servers, storage, networks),enabling convenient, on-demand network access to a shared pool ofconfigurable computing resources that can be rapidly provisioned andreleased with minimal management effort or service provider interaction.Thus, cloud computing allows a user to access virtual computingresources (e.g., storage, data, applications, and even completevirtualized computing systems) in “the cloud,” without regard for theunderlying physical systems (or locations of those systems) used toprovide the computing resources.

Typically, cloud computing resources are provided to a user on apay-per-use basis, where users are charged only for the computingresources actually used (e.g. an amount of storage space consumed by auser or a number of virtualized systems instantiated by the user). Auser can access any of the resources that reside in the cloud at anytime, and from anywhere across the Internet. In context of the presentinvention, a user may access a normalized search engine or related dataavailable in the cloud. For example, the normalized search engine couldexecute on a computing system in the cloud and execute normalizedsearches. In such a case, the normalized search engine could normalize acorpus of information and store an index of the normalizations at astorage location in the cloud. Doing so allows a user to access thisinformation from any computing system attached to a network connected tothe cloud (e.g., the Internet).

It is understood in advance that although this disclosure includes adetailed description on cloud computing, implementation of the teachingsrecited herein are not limited to a cloud computing environment. Rather,embodiments of the present invention are capable of being implemented inconjunction with any other type of computing environment now known orlater developed.

Cloud computing is a model of service delivery for enabling convenient,on-demand network access to a shared pool of configurable computingresources (e.g. networks, network bandwidth, servers, processing,memory, storage, applications, virtual machines, and services) that canbe rapidly provisioned and released with minimal management effort orinteraction with a provider of the service. This cloud model may includeat least five characteristics, at least three service models, and atleast four deployment models.

Characteristics are as follows:

On-demand self-service: a cloud consumer can unilaterally provisioncomputing capabilities, such as server time and network storage, asneeded automatically without requiring human interaction with theservice's provider.

Broad network access: capabilities are available over a network andaccessed through standard mechanisms that promote use by heterogeneousthin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

Resource pooling: the provider's computing resources are pooled to servemultiple consumers using a multi-tenant model, with different physicaland virtual resources dynamically assigned and reassigned according todemand. There is a sense of location independence in that the consumergenerally has no control or knowledge over the exact location of theprovided resources but may be able to specify location at a higher levelof abstraction (e.g., country, state, or datacenter).

Rapid elasticity: capabilities can be rapidly and elasticallyprovisioned, in some cases automatically, to quickly scale out andrapidly released to quickly scale in. To the consumer, the capabilitiesavailable for provisioning often appear to be unlimited and can bepurchased in any quantity at any time.

Measured service: cloud systems automatically control and optimizeresource use by leveraging a metering capability at some level ofabstraction appropriate to the type of service (e.g., storage,processing, bandwidth, and active user accounts). Resource usage can bemonitored, controlled, and reported providing transparency for both theprovider and consumer of the utilized service.

Service Models are as follows:

Software as a Service (SaaS): the capability provided to the consumer isto use the provider's applications running on a cloud infrastructure.The applications are accessible from various client devices through athin client interface such as a web browser (e.g., web-based e-mail).The consumer does not manage or control the underlying cloudinfrastructure including network, servers, operating systems, storage,or even individual application capabilities, with the possible exceptionof limited user-specific application configuration settings.

Platform as a Service (PaaS): the capability provided to the consumer isto deploy onto the cloud infrastructure consumer-created or acquiredapplications created using programming languages and tools supported bythe provider. The consumer does not manage or control the underlyingcloud infrastructure including networks, servers, operating systems, orstorage, but has control over the deployed applications and possiblyapplication hosting environment configurations.

Infrastructure as a Service (IaaS): the capability provided to theconsumer is to provision processing, storage, networks, and otherfundamental computing resources where the consumer is able to deploy andrun arbitrary software, which can include operating systems andapplications. The consumer does not manage or control the underlyingcloud infrastructure but has control over operating systems, storage,deployed applications, and possibly limited control of select networkingcomponents (e.g., host firewalls).

Deployment Models are as follows:

Private cloud: the cloud infrastructure is operated solely for anorganization. It may be managed by the organization or a third party andmay exist on-premises or off-premises.

Community cloud: the cloud infrastructure is shared by severalorganizations and supports a specific community that has shared concerns(e.g., mission, security requirements, policy, and complianceconsiderations). It may be managed by the organizations or a third partyand may exist on-premises or off-premises.

Public cloud: the cloud infrastructure is made available to the generalpublic or a large industry group and is owned by an organization sellingcloud services.

Hybrid cloud: the cloud infrastructure is a composition of two or moreclouds (private, community, or public) that remain unique entities butare bound together by standardized or proprietary technology thatenables data and application portability (e.g., cloud bursting forload-balancing between clouds).

A cloud computing environment is service oriented with a focus onstatelessness, low coupling, modularity, and semantic interoperability.At the heart of cloud computing is an infrastructure comprising anetwork of interconnected nodes.

Referring now to FIG. 6, illustrative cloud computing environment 600 isdepicted. As shown, cloud computing environment 600 includes one or morecloud computing nodes 610 with which local computing devices used bycloud consumers, such as, for example, personal digital assistant (PDA)or cellular telephone 640A, desktop computer 640B, laptop computer 640C,and/or automobile computer system 640N may communicate. Cloud computingnodes 610 may communicate with one another. They may be grouped (notshown) physically or virtually, in one or more networks, such asPrivate, Community, Public, or Hybrid clouds as described hereinabove,or a combination thereof. This allows cloud computing environment 500 tooffer infrastructure, platforms and/or software as services for which acloud consumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 640A-Nshown in FIG. 6 are intended to be illustrative only and that cloudcomputing nodes 610 and cloud computing environment 600 can communicatewith any type of computerized device over any type of network and/ornetwork addressable connection (e.g., using a web browser).

Referring now to FIG. 7, a set of functional abstraction layers providedby cloud computing environment 600 (as shown in FIG. 6) is shown. Itshould be understood in advance that the components, layers, andfunctions shown in FIG. 7 are intended to be illustrative only andembodiments of the invention are not limited thereto. As depicted, thefollowing layers and corresponding functions are provided:

Hardware and software layer 760 includes hardware and softwarecomponents. Examples of hardware components include: mainframes 761;RISC (Reduced Instruction Set Computer) architecture based servers 762;servers 763; blade servers 764; storage devices 765; and networks andnetworking components 766. In some embodiments, software componentsinclude network application server software 767 and database software768.

Virtualization layer 770 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers771; virtual storage 772, for example the data storage device 106 asshown in FIG. 1; virtual networks 773, including virtual privatenetworks; virtual applications and operating systems 774; and virtualclients 775.

In an example, management layer 780 may provide the functions describedbelow. Resource provisioning 781 provides dynamic procurement ofcomputing resources and other resources that are utilized to performtasks within the cloud computing environment. Metering and Pricing 782provide cost tracking as resources are utilized within the cloudcomputing environment, and billing or invoicing for consumption of theseresources. In an example, these resources may include applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.User portal 783 provides access to the cloud computing environment forconsumers and system administrators. Service level management 784provides cloud computing resource allocation and management such thatrequired service levels are met. Service Level Agreement (SLA) planningand fulfillment 685 provide pre-arrangement for, and procurement of,cloud computing resources for which a future requirement is anticipatedin accordance with an SLA.

Workloads layer 790 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation 791; software development and lifecycle management 792;virtual classroom education delivery 793; data analytics processing 794;transaction processing 795; and log file management program 796. The logfile management program 796 may manage a log file such that the log filedoes not exceed a predefined data storage limit.

The present invention may be a system, a method, and/or a computerprogram product at any possible technical detail level of integration.The computer program product may include a computer readable storagemedium (or media) having computer readable program instructions thereonfor causing a processor to carry out aspects of the present invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, configuration data for integrated circuitry, oreither source code or object code written in any combination of one ormore programming languages, including an object oriented programminglanguage such as Smalltalk, C++, or the like, and procedural programminglanguages, such as the “C” programming language or similar programminglanguages. The computer readable program instructions may executeentirely on the user's computer, partly on the user's computer, as astand-alone software package, partly on the user's computer and partlyon a remote computer or entirely on the remote computer or server. Inthe latter scenario, the remote computer may be connected to the user'scomputer through any type of network, including a local area network(LAN) or a wide area network (WAN), or the connection may be made to anexternal computer (for example, through the Internet using an InternetService Provider). In some embodiments, electronic circuitry including,for example, programmable logic circuitry, field-programmable gatearrays (FPGA), or programmable logic arrays (PLA) may execute thecomputer readable program instructions by utilizing state information ofthe computer readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the blocks may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The descriptions of the various example implementations of the presentdisclosure have been presented for purposes of illustration, but are notintended to be exhaustive or limited to the implementations disclosed.Many modifications and variations will be apparent to those of ordinaryskill in the art without departing from the scope and spirit of thedescribed implementations. The terminology used herein was chosen tobest explain the principles of the example implementations, thepractical application or technical improvement over technologies foundin the marketplace, or to enable others of ordinary skill in the art tounderstand the implementations disclosed herein.

What is claimed is:
 1. A computer implemented method, comprising:continually storing a group of data entries in an event log over time,wherein each data entry of the group of data entries is generated inresponse to detection of a predefined condition of a computer system bya monitoring service, a severity level is assigned to each data entry ofthe group of data entries based on a severity of the predefinedcondition associated with each data entry of the group of data entries,a severity level of INFO is assigned at a defined stage of normaloperation, a severity level of WARNING is generated at an unexpectedcondition during generation of a project, a severity level of ERROR isassigned when data is missing after a set period of time; detecting afirst new instance of a predefined condition of the computer system bythe monitoring service; determining there is insufficient data storagespace in the event log for a first new data entry documenting the firstnew instance of the predefined condition; scanning the event log toidentify a first set of data entries of the group of data entriescomprising a severity level less than or equal to INFO; in response toidentifying the first set of data entries, overwriting one or more dataentries of the first set of data entries with the first new data entry;detecting a second new instance of a predefined condition of thecomputer system by the monitoring service; determining there isinsufficient data storage space in the event log for a second new dataentry documenting the second new instance of the predefined condition;re-scanning the event log to identify a second set of data entriesstored in the event log comprising a severity level less than or equalto INFO; and in response to identifying no data entries exist for thesecond set, re-scanning the event log to identify a third set of dataentries stored in the event log comprising a severity level less than orequal to WARNING.
 2. The method according to claim 1, furthercomprising: in response to identifying the third set of data entries,overwriting one or more of the third set of data entries with the secondnew data entry.
 3. The method according to claim 1, further comprising:in response to identifying no data entries exist for the third set,storing the second new data entry in the event log according to adefault overwriting scheme.
 4. The method according to claim 1, furthercomprising: selecting one or more data entries of the first set of dataentries to overwrite with the first new data entry, based on size, ageand content of each data entry of the first set of data entries.
 5. Themethod according to claim 1, further comprising: based on determiningthat a new data entry comprises a severity level less than the thresholdseverity level, discarding the new data entry without storing it in theevent log.
 6. A computer system comprising: one or more processors, oneor more computer-readable storage media, and program instructions storedon the one or more of the computer-readable storage media for executionby at least one of the one or more processors, wherein the computersystem is capable of performing a method comprising: continually store agroup of data entries in an event log over time, wherein each data entryof the group of data entries is generated in response to detection of apredefined condition of a computer system by a monitoring service, aseverity level is assigned to each data entry of the group of dataentries based on a severity of the predefined condition associated witheach data entry of the group of data entries, severity level of INFO isassigned at a defined stage of normal operation, a severity level ofWARNING is generated at an unexpected condition during generation of aproject, a severity level of ERROR is assigned when data is missingafter a set period of time; detecting a first new instance of apredefined condition of the computer system by the monitoring service;determining there is insufficient data storage space in the event logfor a first new data entry documenting the first new instance of thepredefined condition; scanning the event log to identify a first set ofdata entries of the group of data entries comprising a severity levelless than or equal to INFO; in response to identifying the first set ofdata entries, overwriting one or more data entries of the first set ofdata entries with the first new data entry; detecting a second newinstance of a predefined condition of the computer system by themonitoring service; determining there is insufficient data storage spacein the event log for a second new data entry documenting the second newinstance of the predefined condition; re-scanning the event log toidentify a second set of data entries stored in the event log comprisinga severity level less than or equal to the INFO; and in response todetermining no data entries exist for the second set, re-scanning theevent log to identify a third set of data entries stored in the eventlog comprising a severity level less than or equal to WARNING.
 7. Thecomputer system according to claim 6, further comprising: in response toidentifying the third set of data entries, overwriting one or more ofthe third set of data entries with the second new data entry.
 8. Thecomputer system according to claim 6, further comprising: in response toidentifying no data entries exist for the third set, storing the secondnew data entry in the event log according to a default overwritingscheme.
 9. The computer system according to claim 6, further comprising:selecting one or more data entries of the first set of data entries tooverwrite with the first new data entry, based on size, age and contentof each data entry of the first set of data entries.
 10. The computersystem according to claim 6, further comprising: based on determiningthat a new data entry comprises a severity level less than the thresholdseverity level, discarding the new data entry without storing it in theevent log.
 11. A computer program product comprising: one or morecomputer-readable tangible storage medium and program instructionsstored on at least one of the one or more tangible storage medium, theprogram instructions executable by a processor, the program instructionscomprising: continually store a group of data entries in an event logover time, wherein each data entry of the group of data entries isgenerated in response to detection of a predefined condition of acomputer system by a monitoring service, a severity level is assigned toeach data entry of the group of data entries based on a severity of thepredefined condition associated with each data entry of the group ofdata entries, severity level of INFO is assigned at a defined stage ofnormal operation, a severity level of WARNING is generated at anunexpected condition during generation of a project, a severity level ofERROR is assigned when data is missing after a set period of time;detecting a first new instance of a predefined condition of the computersystem by the monitoring service; determining there is insufficient datastorage space in the event log for a first new data entry documentingthe first new instance of the predefined condition; scanning the eventlog to identify a first set of data entries of the group of data entriescomprising a severity level less than or equal to INFO; in response toidentifying the first set of data entries, overwriting one or more dataentries of the first set of data entries with the first new data entry;detecting a second new instance of a predefined condition of thecomputer system by the monitoring service; determining there isinsufficient data storage space in the event log for a second new dataentry documenting the second new instance of the predefined condition;re-scanning the event log to identify a second set of data entriesstored in the event log comprising a severity level less than or equalto the INFO; and in response to determining no data entries exist forthe second set, re-scanning the event log to identify a third set ofdata entries stored in the event log comprising a severity level lessthan or equal to WARNING.
 12. The computer program product according toclaim 11, further comprising: in response to identifying the third setof data entries, overwriting one or more of the third set of dataentries with the second new data entry.
 13. The computer program productaccording to claim 11, further comprising: in response to identifying nodata entries exist for the third set, storing the second new data entryin the event log according to a default overwriting scheme.
 14. Thecomputer program product according to claim 11, further comprising:selecting one or more data entries of the first set of data entries tooverwrite with first new data entry, based on size, age and content ofeach data entry of the first set of data entries.
 15. The computerprogram product according to claim 11, further comprising: based ondetermining that a new data entry comprises a severity level less thanthe threshold severity level, discarding the new data entry withoutstoring it in the event log.